![](/screenshots/ef3f6573-d111-489c-aab3-e38b821aa784.png)
as56asd5a-55a5a.wezzpage.hu
Open in
urlscan Pro
87.229.70.249
Malicious Activity!
Public Scan
Effective URL: http://as56asd5a-55a5a.wezzpage.hu/media/files/index.html.html
Submission: On July 20 via automatic, source openphish
Summary
This is the only time as56asd5a-55a5a.wezzpage.hu was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 2606:4700:303... 2606:4700:3036::ac43:9551 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 87.229.70.249 87.229.70.249 | 62292 (EZIT-AS) (EZIT-AS) | |
1 | 2606:4700::68... 2606:4700::6812:17cf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 64.90.42.230 64.90.42.230 | 26347 (DREAMHOST-AS) (DREAMHOST-AS) | |
1 | 67.202.94.94 67.202.94.94 | 32748 (STEADFAST) (STEADFAST) | |
1 | 2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3 | 32934 (FACEBOOK) (FACEBOOK) | |
7 | 7 |
ASN26347 (DREAMHOST-AS, US)
PTR: apache2-quack.sthelens.dreamhost.com
mega-scripts.biz |
ASN32934 (FACEBOOK, US)
static.xx.fbcdn.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
8to.us
8to.us |
1 KB |
1 |
fbcdn.net
static.xx.fbcdn.net |
2 KB |
1 |
amung.us
whos.amung.us |
27 B |
1 |
mega-scripts.biz
mega-scripts.biz |
28 KB |
1 |
codesandbox.io
codesandbox.io |
2 KB |
1 |
wezzpage.hu
as56asd5a-55a5a.wezzpage.hu |
920 B |
7 | 6 |
Domain | Requested by | |
---|---|---|
2 | 8to.us |
8to.us
|
1 | static.xx.fbcdn.net |
as56asd5a-55a5a.wezzpage.hu
|
1 | whos.amung.us |
as56asd5a-55a5a.wezzpage.hu
|
1 | mega-scripts.biz |
as56asd5a-55a5a.wezzpage.hu
|
1 | codesandbox.io |
as56asd5a-55a5a.wezzpage.hu
|
1 | as56asd5a-55a5a.wezzpage.hu |
8to.us
|
7 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-07-19 - 2022-07-18 |
a year | crt.sh |
codesandbox.io Cloudflare Inc ECC CA-3 |
2021-05-19 - 2022-05-18 |
a year | crt.sh |
www.mega-scripts.biz R3 |
2021-06-02 - 2021-08-31 |
3 months | crt.sh |
whos.amung.us Sectigo RSA Domain Validation Secure Server CA |
2020-05-21 - 2022-05-21 |
2 years | crt.sh |
*.facebook.com DigiCert SHA2 High Assurance Server CA |
2021-05-26 - 2021-08-24 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://as56asd5a-55a5a.wezzpage.hu/media/files/index.html.html
Frame ID: E86748FA3D8E1711E63A1F04E0135457
Requests: 8 HTTP requests in this frame
Screenshot
![](/screenshots/ef3f6573-d111-489c-aab3-e38b821aa784.png)
Page URL History Show full URLs
- https://8to.us/b58c8 Page URL
- http://as56asd5a-55a5a.wezzpage.hu/media/files/index.html.html Page URL
Detected technologies
Detected patterns
- headers server /^cloudflare$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://8to.us/b58c8 Page URL
- http://as56asd5a-55a5a.wezzpage.hu/media/files/index.html.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
b58c8
8to.us/ |
181 B 716 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
jcbcode.js
8to.us/ |
101 B 806 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
index.html.html
as56asd5a-55a5a.wezzpage.hu/media/files/ |
1 KB 920 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
watermark-button.be960f43b.js
codesandbox.io/static/js/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
mega-scripts.biz/ |
167 KB 28 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
whos.amung.us/pingjs/ |
27 B 27 B |
Image
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dF5SId3UHWd.svg
static.xx.fbcdn.net/rsrc.php/y8/r/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)17 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated string| d object| dom string| back boolean| ignoreHistoryChange boolean| ignoreHashChange string| kon object| _$_f395 string| head string| bod0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
8to.us
as56asd5a-55a5a.wezzpage.hu
codesandbox.io
mega-scripts.biz
static.xx.fbcdn.net
whos.amung.us
2606:4700:3036::ac43:9551
2606:4700::6812:17cf
2a03:2880:f01c:8012:face:b00c:0:3
64.90.42.230
67.202.94.94
87.229.70.249
1230532f79456753fb73f559ece9b95c17cfb36325dc313a3eda5ac22dfd9a2b
38bca8e8995deccf0efb2b9a65d949ba3e2bb5f7012b0094879893b6129fd06e
42420aafe24694cddb54fcaff0b898657c14907d97544c5eafab425c58ecbb99
9531e96099e973b3d1c291f3e60419d8fe4730f46de8a492fccd2b4c962c96ce
c54e3596ca5bc23af15d182227beffe1fd11ae7b1f114a224a1aebc229df88eb
decac2c1e5ad922e9e9f30ba9451c75da4a6c5ce351b117a66e0b5f184af21ab
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ec44f80f5508fb93467679fa25832bb77c4384e024be91ef1ab98281732d0ec7